Need help with a virus crippled xp

[fubar]

I need some help with a computer that was extremely infected with several viruses. I know "viruses" isn't grammatically correct but it sounds better to me.

Anyway, this is a friends computer that was just dumped on me by my wife yesterday and it's really messed up. It had several different viruses that I was able to remove by using a Kaspersky rescue disc. I do not have access to the log file as it is on the computer, which is not working correctly now that the infected files are gone. Which brings me to the problem.

The machine will boot up to a blank desktop with a working mouse cursor but that's it. There is nothing else I can do. There are no icons and left or right click does nothing. Not even ctrl-alt-del, or ctrl-shift-esc will do anything.

I've tried booting into safe mode but as soon as it begins I get a stop error.

When I place a cd in the drive and close it I will see the spinning disc icon attached to the mouse cursor but then nothing else will happen. But it appears to be reading the disc. Feels like if I could just get to a command prompt I could run explorer.exe and get everything back on line.

I've tried doing a repair install with an xp cd but it doesn't recognize the os and wants to install a fresh copy. I would let it do that but I am concerned that it would reformat first, and I know there are files that the owner needs, so I am reluctant to go that route.

If you look at the attached screen shot of xp setup you will see where I am with it. My question is if I go with the highlighted selection (Leave the current file system intact-no changes) will xp reformat or will it just install xp to a new folder?

Oh yeah, this is xp home edition that's on a Dell.

Thanks...Randy

[Welshjim]

fubar--Dell PC's usually come with a Recovery Disk. The only problem is that it basically restores the HardDrive to its condition when it left Dell's factory. No personal data, settings, etc. That seems to not be what the owner wants.
This seems to be the disk being used in your screenshot.
http://www.pctechbytes.com/dell.htm

I've tried doing a repair install with an xp cd but it doesn't recognize the os and wants to install a fresh copy

To run a Repair Install you have to use a WinXP CD with the same version and same Service Pack as is on the PC. You can use a borrowed one, but when the time comes you enter the Product Key of the original install on the PC. This is NOT the Dell System Restore CD.
http://www.dougknox.com/xp/tips/xp_repair_install.htm
(You can also make a slipstreamed CD, but maybe wait to see if needed since it is a little complicated if not needed.)
Dell may be willing to sell you a real WinXP CD for a fairly low price (like $15-20) if you can wait.
Other ideas.
Try to boot into Safe Mode. Do you get the Desktop?
If successful, try to open TaskManager. Click File|New Task (Run)|enter Explorer on the line in the next window and click OK. Does your desktop come up?
Can you download these files from another PC and run them on yours
http://www.kellys-korner-xp.com/xp_tweaks.htm 195 Right and 117 Left.
If you are successful with any of these, backup all personal data to an external location (USB external drive, USB flash drive, DVD, etc). Now if you have to use the Dell Recovery Disk you can restore the personal data quite easily, though all install programs and updates will have to be reinstalled.
Another way to handle the personal data would be to transfer the hard drive to another working PC and see what can be backed up from there.

[fubar]

You're correct, I am not using the Dell restore cd. I am using my own XP cd...I didn't think it would matter on the version and I didn't care about the sp ver. I could always reinstall those. But I guess it does matter so now I will try to get the restore cd from the owner. This ought to be good. It's been my experience that they usually have no idea where those discs are.

I cannot get this machine into safe mode. I keep getting a 0x7b error code, and that could be a number of things. I don't think that it's the virus otherwise I would think that I would get the same error booting normally. This is really odd. It's usually the other way around.

I've decided the best thing to do is to do a complete restore. Not sure how stable this machine would be after a repair, given the severity of the infections. I will take their drive out and slave it to my pc with a usb adapter that I have and then back up their files...if I can figure out which ones they want. Hopefully they have saved them all in my doc folder.

Thanks for the help, Welshjim.

Randy

[fubar]

Update:

Well you were right. I was able to get the restore cd and when I ran it it came up with the repair option. So I am letting it do the repair now and if all goes well I will return it to the owner and ask them to backup the files that they want and then I will wipe the drive and reinstall everything.

I would really prefer to wipe it now but, since I am doing this as a favor I just don't want to take the time to sift through all of their files to try and figure out exactly what they want to keep. I'd rather let them do that. We'll see if they will.

Thanks again...Randy

[SpywareDr]

FWIW, some of the most common and important folder locations that usually need to be backed up are:

• My Documents
  
  C:\Documents and Settings\<username>\My Documents
  
  
• Favorites
  
  C:\Documents and Settings\<username>\Favorites
  
  
• Desktop
  
  C:\Documents and Settings\<username>\Desktop
  
  
• Templates
  
  C:\Documents and Settings\<username>\Templates
  
  
• Shared Documents
  
  C:\Documents and Settings\All Users\Documents
  
  
• Address Book
  
  C:\Documents and Settings\<username>\Application Data\Address Book
  
  
• Outlook
  
  C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Outlook
  
  
• Outlook Express
  
  C:\Documents and Settings\<username>\Local Settings\Application Data\Identities\{ADB1F817-514C-4C8B-B041-62663357884B}\Microsoft\Outlook Express